CVE-2026-44430 MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist
Attackers can bypass IP allowlists via IPv6 tunneling to access internal services or cloud metadata in the MCP Registry.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44430?
CVE-2026-44430 is a medium-severity server-side request forgery vulnerability in modelcontextprotocol registry, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to refuse dialling private/internal addresses when fetching the well-known public-key file from a publisher-supplied domain. The blocklist (isBlockedIP, lines 125-133) relies entirely on Go stdlib's IsLoopback / IsPrivate / IsLinkLocalUnicast / IsMulticast / IsUnspecified plus a manual CGNAT range. None of these cover IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48 per RFC 8215), or deprecated site-local (fec0::/10) — all of which encode arbitrary IPv4 in the address bits and tunnel to RFC1918 / cloud-metadata services on dual-stack / NAT64-enabled hosts. This vulnerability is fixed in 1.7.7.
Weakness: CWE-918
Which versions are affected by CVE-2026-44430?
3 open source packages ship an affected version, including github.com/modelcontextprotocol/registry. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/modelcontextprotocol/registry Go | All versions | 1.7.7 |
github.com/modelcontextprotocol/registry Go | All versions | 1.7.7 |
github.com/modelcontextprotocol/registry Go | All versions | 1.7.7 |
Products include Lfprojects Mcp Registry.
How do I fix CVE-2026-44430?
Upgrade github.com/modelcontextprotocol/registry to 1.7.7 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-44430 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44430 exists.
Other vulnerabilities in modelcontextprotocol registry
Sources
Also known as GHSA-r48c-v28r-pf6v, GO-2026-5607.